Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:52565
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.42 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:user-agent:mime-version:to:subject
         :content-type;
        b=EscrHKVQJPD6HgsBmJDQdKRPxbKF2TWavt65b4ZpuGvJOhnTYR0Yjv3X+AThoJzkes
         WUbt+7CIWaX4sEWhVhPaW6yEFPC8qT4TXnBOHQoggYBr1+VHGKfTYStu/6TeBz1WM3uv
         1h3DIUwcpcEeAFuDIsUvxBQ2+puoLXBoRbVu8=
Message-ID: <4DE5104D.4030601@gmail.com>
Date: Tue, 31 May 2011 18:59:09 +0300
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.17) Gecko/20110424 Thunderbird/3.1.10
MIME-Version: 1.0
To: internals@lists.php.net
Content-Type: multipart/mixed;
 boundary="------------060609010804010605080008"
Subject: Typecasting in ArrayObject::offsetGet and ArrayObject::offsetSet
From: kamazee@gmail.com (Alex S Kurilo)

--------------060609010804010605080008
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hello.

Typecasting on the index passed to ArrayObject::offsetGet and 
ArrayObject::offsetSet seems to be the reason of ArrayObject's confusing 
behavior on x86 systems.

According to 
http://php.net/manual/en/language.types.integer.php#language.types.integer.overflow,

> If PHP encounters a number beyond the bounds of the integer type, it will be interpreted as a float instead. Also, an operation which results in a number beyond the bounds of the integer type will return a float instead.

So, integer is casted to float, then it's passed to 
ArrayObject::offsetSet and is casted back to integer, probably due to 
the following lines (ext/spl/spl_array.c:348):
                  if (offset->type == IS_DOUBLE) {
                          index = (long)Z_DVAL_P(offset);
                  } else {
                          index = Z_LVAL_P(offset);
                  }

As a result of calling ArrayObject::offsetSet(index, value) on x86 with 
a float index exceeds 'long', value appears under a non-obvious index 
and is replaced on every other call with greater than 'long' index.

Tests are attached. test_array.phpt is passed on both x86 and x86_64, 
test_array_object.phpt fails to pass on x86 (but is passed on x86_64). 
This difference in array's and ArrayObject's behavior made me to 
consider this a bug.

array_object_error.php on x86 just makes pretty clear the reason of fail 
(see notices PHP throws).

--------------060609010804010605080008
Content-Type: text/plain;
 name="test_array.phpt"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename="test_array.phpt"

LS1URVNULS0KdGVzdCAxCi0tRklMRS0tCjw/cGhwCi8vJGFycmF5ID0gbmV3IEFycmF5T2Jq
ZWN0OwokYXJyYXkgPSBhcnJheSgpOwoKJGtleTEgPSAxZTk7CiRrZXkyID0gJGtleTEgKiAx
MDsKJGtleTMgPSAka2V5MiArIDE7CiRhcnJheVska2V5MV0gPSAiYSI7CiRhcnJheVska2V5
Ml0gPSAiYiI7CiRhcnJheVska2V5M10gPSAiYyI7CgplY2hvICRhcnJheVska2V5MV0sJGFy
cmF5WyRrZXkyXSwkYXJyYXlbJGtleTNdOwotLUVYUEVDVC0tCmFiYwo=
--------------060609010804010605080008
Content-Type: text/plain;
 name="test_array_object.phpt"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename="test_array_object.phpt"

LS1URVNULS0KdGVzdCAxCi0tRklMRS0tCjw/cGhwCiRhcnJheSA9IG5ldyBBcnJheU9iamVj
dDsKLy8kYXJyYXkgPSBhcnJheSgpOwoKJGtleTEgPSAxZTk7CiRrZXkyID0gJGtleTEgKiAx
MDsKJGtleTMgPSAka2V5MiArIDE7CiRhcnJheVska2V5MV0gPSAiYSI7CiRhcnJheVska2V5
Ml0gPSAiYiI7CiRhcnJheVska2V5M10gPSAiYyI7CgplY2hvICRhcnJheVska2V5MV0sJGFy
cmF5WyRrZXkyXSwkYXJyYXlbJGtleTNdOwotLUVYUEVDVC0tCmFiYwo=
--------------060609010804010605080008
Content-Type: application/x-httpd-php;
 name="array_object_error.php"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename="array_object_error.php"

PD9waHAKaW5pX3NldCgnZXJyb3JfcmVwb3J0aW5nJywgRV9BTEwpOwppbmlfc2V0KCdkaXNw
bGF5X2Vycm9ycycsIFRSVUUpOwokYXJyYXkgPSBuZXcgQXJyYXlPYmplY3Q7Ci8vJGFycmF5
ID0gYXJyYXkoKTsKJGtleTEgPSB0aW1lKCk7CiRrZXkyID0gJGtleTEgKiAxMDsKJGtleTMg
PSAka2V5MiArIDE7CiRrZXk0ID0gJGtleTMgKyAxOwokYXJyYXlbJGtleTFdID0gImEiOwov
LyRhcnJheVska2V5Ml0gPSAiYiI7Ci8vJGFycmF5WyRrZXkzXSA9ICJjIjsKCgplY2hvICRr
ZXkxLCc6ICcsJGFycmF5WyRrZXkxXSwgIlxuIjsKZWNobyAka2V5MiwnOiAnLCRhcnJheVsk
a2V5Ml0sICJcbiI7CmVjaG8gJGtleTMsJzogJywkYXJyYXlbJGtleTNdLCAiXG4iOwo=
--------------060609010804010605080008--